Ship trust-first CLI and runtime defaults

tests/test_api.py

@@ -25,6 +25,7 @@ def test_pyro_run_in_vm_delegates_to_manager(tmp_path: Path) -> None:
         timeout_seconds=30,
         ttl_seconds=600,
         network=False,
+        allow_host_compat=True,
     )
     assert int(result["exit_code"]) == 0
     assert str(result["stdout"]) == "ok\n"
@@ -74,12 +75,30 @@ def test_pyro_vm_run_tool_executes(tmp_path: Path) -> None:
                 {
                     "environment": "debian:12-base",
                     "command": "printf 'ok\\n'",
-                    "vcpu_count": 1,
-                    "mem_mib": 512,
                     "network": False,
+                    "allow_host_compat": True,
                 },
             )
         )
 
     result = asyncio.run(_run())
     assert int(result["exit_code"]) == 0
+
+
+def test_pyro_create_vm_defaults_sizing_and_host_compat(tmp_path: Path) -> None:
+    pyro = Pyro(
+        manager=VmManager(
+            backend_name="mock",
+            base_dir=tmp_path / "vms",
+            network_manager=TapNetworkManager(enabled=False),
+        )
+    )
+
+    created = pyro.create_vm(
+        environment="debian:12-base",
+        allow_host_compat=True,
+    )
+
+    assert created["vcpu_count"] == 1
+    assert created["mem_mib"] == 1024
+    assert created["allow_host_compat"] is True